CODEWITHSUNDEEP
azure-application-insightsazure-data-explorerkql
Tom Wright
Tom Wright

Reputation: 11489

How can I introduce a constant reference line based on an aggregation to a Kusto timechart?

I've got a simple KQL query that plots the (log of the) count of all exceptions over 90 days:

exceptions
| where timestamp > ago(90d)
| summarize log(count()) by bin(timestamp, 1d)
| render timechart

What I'd like to do is add some reference lines to the timechart this generates. Based on the docs, this is pretty straightforward:

| extend ReferenceLine = 8

The complicating factor is that I'd like these reference lines to be based on aggregations of the value I'm plotting. For instance, I'd like a reference line for the minimum, mean, and 3rd quartile values.

Focusing on the first of these (minimum), it turns out that you can't use min() outside of summarize(). But I can use this within an extend().

I was drawn to min_of(), but this expects a list of arguments instead of a column. I'm thinking I could probably expand the column into a series of values, but this feels hacky and would fall down beyond a certain number of values.

What's the idiomatic way of doing this?

Upvotes: 2

Views: 2925

Answers (1)

Yoni L.
Yoni L.

Reputation: 25995

you could try something like the following:

exceptions
| where timestamp > ago(90d)
| summarize c = log(count()) by bin(timestamp, 1d)
| as hint.materialized=true T
| extend _min = toscalar(T | summarize min(c)),
         _perc_50 = toscalar(T | summarize percentile(c, 50))
| render timechart

Upvotes: 5

Related Questions